2024 CVEs (page 29)
Page 29 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-12467 | Medium | 6.1 | 2025-02-22 | The Pago por Redsys plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'Ds_MerchantParameters' parameter in all versions up to, and i… |
CVE-2024-12038 | Medium | 6.4 | 2025-02-22 | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to St… |
CVE-2024-13899 | High | 7.2 | 2025-02-22 | The Mambo Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0 via deserialization of untrusted input… |
CVE-2024-13873 | Medium | 4.3 | 2025-02-22 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in al… |
CVE-2024-22341 | Medium | 5.3 | 2025-02-22 | IBM Watson Query on Cloud Pak for Data 4.0.0 through 4.0.9, 4.5.0 through 4.5.3, 4.6.0 through 4.6.6, 4.7.0 through 4.7.4, and 4.8.0 through 4.8.7 could allow… |
CVE-2024-45674 | Low | 3.3 | 2025-02-22 | IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gat… |
CVE-2024-57176 | High | 7.6 | 2025-02-21 | An issue in the shiroFilter function of White-Jotter project v0.2.2 allows attackers to execute a directory traversal and access sensitive endpoints via a craf… |
CVE-2024-55159 | Medium | 4.2 | 2025-02-21 | GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the SortName parameter at /system/loginLog/list. |
CVE-2024-55156 | Medium | 5.5 | 2025-02-21 | An XML External Entity (XXE) vulnerability in the deserializeArgs() method of Java SDK for CloudEvents v4.0.1 allows attackers to access sensitive information… |
CVE-2024-45673 | Medium | 5.5 | 2025-02-21 | IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gat… |
CVE-2024-10222 | Medium | 6.4 | 2025-02-21 | The SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.5.10 due to insu… |
CVE-2024-9150 | | 2025-02-21 | Report generation functionality in Wyn Enterprise allows for code inclusion, but not sufficiently limits what code might be included. An attacker is able use a… | |
CVE-2024-13900 | Medium | 4.1 | 2025-02-21 | The Head, Footer and Post Injections plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.3.0. This makes it possib… |
CVE-2024-13846 | Medium | 4.9 | 2025-02-21 | The Indeed Ultimate Learning Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘post_id’ parameter in all versions up to, and includin… |
CVE-2024-13713 | Medium | 6.5 | 2025-02-21 | The WPExperts Square For GiveWP plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.3.1 due to… |
CVE-2024-13455 | Medium | 6.4 | 2025-02-21 | The igumbi Online Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'igumbi_calendar' shortcode in all versions up to… |
CVE-2024-13648 | Medium | 6.4 | 2025-02-21 | The Maps for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MapOnePoint' shortcode in all versions up to, and including… |
CVE-2024-13461 | Medium | 6.4 | 2025-02-21 | The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autoship-create-sc… |
CVE-2024-13353 | High | 8.8 | 2025-02-21 | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Local File Inclusion in all ve… |
CVE-2024-12452 | Medium | 6.4 | 2025-02-21 | The Ziggeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ziggeo_event' shortcode in all versions up to, and including, 3… |
CVE-2024-12276 | Medium | 5.3 | 2025-02-21 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to second… |
CVE-2024-13585 | Low | 3.5 | 2025-02-21 | The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-13314 | Low | 3.5 | 2025-02-21 | The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.7.4 does not sanitise and escape some of its settings, which could allow high privilege… |
CVE-2024-11260 | High | 7.5 | 2025-02-21 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the active_status parameter in a… |
CVE-2024-13883 | Medium | 4.3 | 2025-02-21 | The WPUpper Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.51. This is due to missing o… |
CVE-2024-13818 | Medium | 5.3 | 2025-02-21 | The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress… |
CVE-2024-13751 | Medium | 6.4 | 2025-02-21 | The 3D Photo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'des[]' parameter in all versions up to, and including, 1.3 due… |
CVE-2024-13672 | Medium | 6.4 | 2025-02-21 | The Mini Course Generator | Embed mini-courses and interactive content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mcg'… |
CVE-2024-13537 | Medium | 5.3 | 2025-02-21 | The C9 Blocks plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.7.7. This is due the plugin containing a publi… |
CVE-2024-13388 | Medium | 6.4 | 2025-02-21 | The TCBD Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcbdtooltip_text' shortcode in all versions up to, and inc… |
CVE-2024-13379 | Medium | 6.4 | 2025-02-21 | The C9 Admin Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.3.5 due t… |
CVE-2024-13235 | Medium | 6.5 | 2025-02-21 | The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'language' parameter in all versions up t… |
CVE-2024-38657 | Medium | 4.9 | 2025-02-21 | External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated… |
CVE-2024-54756 | Critical | 9.8 | 2025-02-20 | A remote code execution (RCE) vulnerability in the ZScript function of ZDoom Team GZDoom v4.13.1 allows attackers to execute arbitrary code via supplying a cra… |
CVE-2024-7141 | | 2025-02-20 | Versions of Gliffy Online prior to versions 4.14.0-7 contains a Cross Site Request Forgery (CSRF) flaw. | |
CVE-2024-55457 | Medium | 6.5 | 2025-02-20 | MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the fi… |
CVE-2024-54961 | Medium | 6.5 | 2025-02-20 | Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the usernames and emai… |
CVE-2024-54960 | Medium | 6.5 | 2025-02-20 | A SQL Injection vulnerability in Nagios XI 2024R1.2.2 allows a remote attacker to execute SQL injection via a crafted payload in the History Tab component. |
CVE-2024-54959 | Medium | 6.1 | 2025-02-20 | Nagios XI 2024R1.2.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack through the Favorites component, enabling POST-based Cross-Site Scripting (XSS… |
CVE-2024-54958 | Medium | 6.1 | 2025-02-20 | Nagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page. This flaw allows an attacker to inject malicious sc… |
CVE-2024-46933 | High | 7.7 | 2025-02-20 | An issue was discovered in Atos Eviden BullSequana XH2140 BMC before C4EM-125: OMF_C4E 101.05.0014. Some BullSequana XH products were shipped without proper ha… |
CVE-2024-57716 | High | 7.5 | 2025-02-20 | An issue in trenoncourt AutoQueryable v.1.7.0 allows a remote attacker to obtain sensitive information via the Unselectable function. |
CVE-2024-57401 | Critical | 9.8 | 2025-02-20 | SQL Injection vulnerability in Uniclare Student portal v.2 and before allows a remote attacker to execute arbitrary code via the Forgot Password function. |
CVE-2024-49781 | High | 7.1 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker… |
CVE-2024-49779 | Medium | 4.3 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages could allow a remote attacker to bypass security restrictions, caused by improper validation and manageme… |
CVE-2024-49344 | Medium | 4.3 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages with Watson Assistant chat feature enabled the application establishes a session when a user logs in an… |
CVE-2024-49337 | Medium | 5.4 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to HTML injection, caused by improper validation of user-supplied input of text fields… |
CVE-2024-6432 | Medium | 6.4 | 2025-02-20 | The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter within the plugin's short… |
CVE-2024-13855 | Medium | 4.3 | 2025-02-20 | The Prime Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.1 via the pae_g… |
CVE-2024-13849 | Medium | 5.5 | 2025-02-20 | The Cookie Notice Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.0 due to insufficient input s… |
CVE-2024-13802 | Medium | 6.4 | 2025-02-20 | The Bandsintown Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bandsintown_events' shortcode in all versions up to… |
CVE-2024-13792 | High | 7.3 | 2025-02-20 | The WooCommerce Food - Restaurant Menu & Food ordering plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including… |
CVE-2024-13789 | Critical | 9.8 | 2025-02-20 | The ravpage plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.31 via deserialization of untrusted input from t… |
CVE-2024-13753 | High | 8.1 | 2025-02-20 | The Ultimate Classified Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to mis… |
CVE-2024-13748 | Medium | 4.4 | 2025-02-20 | The Ultimate Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title parameter in all versions up to, and including… |
CVE-2024-13520 | Medium | 5.3 | 2025-02-20 | The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to… |
CVE-2024-13476 | High | 7.5 | 2025-02-20 | The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to SQL Injection via the 'engtz_wd_save_dropship' AJAX endpoint in all versions… |
CVE-2024-13888 | High | 7.2 | 2025-02-20 | The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the… |
CVE-2024-13155 | Medium | 6.4 | 2025-02-20 | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Transparent Split Hero widget in all ve… |
CVE-2024-13445 | Medium | 6.4 | 2025-02-20 | The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the border, margin and gap… |
CVE-2024-49782 | Medium | 6.8 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 could allow a remote attacker to spoof mail server identity when using SSL/TLS security. An attacker could exploit th… |
CVE-2024-49780 | Medium | 5.3 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages could allow a remote attacker to traverse directories on the system. An attacker with privileges to perform… |
CVE-2024-49355 | Medium | 5.3 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 may write improperly neutralized data to server log files when the tracing is enabled per the System Tracing feature. |
CVE-2024-43196 | Medium | 4.3 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 application could allow an authenticated user to manipulate data in the Questionnaires application allowing the user to… |
CVE-2024-6697 | Medium | 6.5 | 2025-02-20 | The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions… |
CVE-2024-6696 | Medium | 4.9 | 2025-02-20 | The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a sy… |
CVE-2024-37363 | Medium | 6.5 | 2025-02-20 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862) Hitachi Vantara Pentaho… |
CVE-2024-37362 | Medium | 6.3 | 2025-02-20 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (… |
CVE-2024-37361 | Critical | 9.9 | 2025-02-20 | The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502) Hitachi Vantara Pentaho Bus… |
CVE-2024-12284 | High | 8.8 | 2025-02-20 | Authenticated privilege escalation in NetScaler Console and NetScaler Agent allows. |
CVE-2024-5706 | High | 8.8 | 2025-02-19 | The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a res… |
CVE-2024-5705 | High | 8.8 | 2025-02-19 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This… |
CVE-2024-37360 | Medium | 4.4 | 2025-02-19 | Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The software… |
CVE-2024-37359 | High | 8.6 | 2025-02-19 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that th… |
CVE-2024-53974 | Medium | 5.4 | 2025-02-19 | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2024-45777 | Medium | 6.7 | 2025-02-19 | A flaw was found in grub2. The calculation of the translation buffer when reading a language .mo file in grub_gettext_getstr_from_position() may overflow, lead… |
CVE-2024-52541 | High | 8.2 | 2025-02-19 | Dell Client Platform BIOS contains a Weak Authentication vulnerability. A high privileged attacker with local access could potentially exploit this vulnerabili… |
CVE-2024-45084 | High | 8.0 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated attacker to conduct formula injection. An attacker cou… |
CVE-2024-45081 | Medium | 6.5 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated user to modify restricted content due to incorrect a… |
CVE-2024-28780 | Medium | 5.9 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 Rich Client uses weaker than expected cryptographic algorithms that could allow… |
CVE-2024-28777 | High | 8.8 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to unrestricted deserialization. This vulnerability allows users to… |
CVE-2024-28776 | Medium | 5.4 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arb… |
CVE-2024-52902 | High | 8.8 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 client application contains hard coded database passwords in source code which could… |
CVE-2024-13534 | High | 7.5 | 2025-02-19 | The Small Package Quotes – Worldwide Express Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in… |
CVE-2024-13533 | High | 7.5 | 2025-02-19 | The Small Package Quotes – USPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to, and including, 1… |
CVE-2024-13491 | High | 7.5 | 2025-02-19 | The Small Package Quotes – For Customers of FedEx plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in al… |
CVE-2024-13485 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all ver… |
CVE-2024-13483 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – SAIA Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions u… |
CVE-2024-13481 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all ve… |
CVE-2024-13479 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – SEFL Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions u… |
CVE-2024-13478 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – TForce Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions… |
CVE-2024-13489 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – Old Dominion Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all ve… |
CVE-2024-13364 | Medium | 5.3 | 2025-02-19 | The Raptive Ads plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the site_ads_files_reset() and cls_file_reset()… |
CVE-2024-13363 | Medium | 6.1 | 2025-02-19 | The Raptive Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'poc' parameter in all versions up to, and including, 3.6.3 due to… |
CVE-2024-13339 | Medium | 6.1 | 2025-02-19 | The DeBounce Email Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.8.0. This is due to missi… |
CVE-2024-13336 | Medium | 4.3 | 2025-02-19 | The Disable Auto Updates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or… |
CVE-2024-13231 | Medium | 5.3 | 2025-02-19 | The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2024-13854 | Medium | 4.3 | 2025-02-19 | The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 via the na… |
CVE-2024-13736 | Medium | 6.1 | 2025-02-19 | The Pure Chat – Live Chat & More! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘purechatWidgetName’ parameter in all versions up t… |
CVE-2024-13719 | Medium | 5.3 | 2025-02-19 | The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoic… |